Input validation error - CVE-2012-6687

Vulnerability identifier: #VU33027

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-6687

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections.

fcgi (Alpine package)
perl-FCGI
perl-FCGI-debuginfo
perl-FCGI-debugsource
perl-FCGI-help
openEuler

Install update from vendor's website.

fcgi (Alpine package) - addressed in versions 2.4.0-r7, 2.4.0-r8, 2.4.2-r0
perl-FCGI - update to 0.78-13
perl-FCGI-debuginfo - update to 0.78-13
perl-FCGI-debugsource - update to 0.78-13
perl-FCGI-help - update to 0.78-13

• http://advisories.mageia.org/MGASA-2015-0184.html
• http://www.openwall.com/lists/oss-security/2015/02/06/4
• http://www.openwall.com/lists/oss-security/2015/02/07/4
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681591
• https://bugs.launchpad.net/ubuntu/+source/libfcgi/+bug/933417
• https://bugzilla.redhat.com/show_bug.cgi?id=1189958
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100696

• Input validation error in fcgi (Alpine package)
• openEuler update for perl-FCGI